{"categories":[{"label":"Python Modules","url":"https://skillfed.io/packages/category/software-development-libraries-python-modules/17"},{"label":"Dynamic Content","url":"https://skillfed.io/packages/category/internet-www-http-dynamic-content/3"}],"enrichment":{"capability":"Adds stateless CSRF protection to FastAPI applications using the Double Submit Cookie pattern, with support for token validation in request headers or form bodies.","skillfed_tags":["csrf-protection","security","fastapi-extension"],"use_cases":["Protect FastAPI form submissions from CSRF attacks by validating tokens in POST/PUT/DELETE requests.","Add CSRF defense to hybrid applications serving both HTML forms and JSON APIs from the same FastAPI instance.","Migrate from flask-wtf to FastAPI while keeping a familiar CSRF protection pattern.","Validate CSRF tokens in AJAX requests by reading them from cookies and sending them in request headers.","Prevent token reuse by unsetting the CSRF cookie after successful form submission."],"what_it_does":"fastapi-csrf-protect is a FastAPI extension that implements stateless Cross-Site Request Forgery (CSRF) protection using the Double Submit Cookie mitigation pattern. It generates CSRF tokens, stores them in cookies, and validates incoming requests by comparing the token in the cookie against a token in the request header or form body. The package is designed as a lightweight, easy-to-use alternative to heavier CSRF solutions, inspired by flask-wtf.\n\nThe library works by generating a pair of tokens (a plain token and a signed token), setting the signed token as a cookie, and requiring the client to send the plain token back in either an HTTP header (X-CSRFToken) or form field. A flexible mode allows accepting tokens from either location, useful for applications mixing server-side rendering with API endpoints. Configuration is done via a Pydantic settings class, and validation failures raise CsrfProtectError exceptions that can be caught with a custom exception handler.","worth_installing":"Yes, with conditions. Install if you need lightweight, stateless CSRF protection in FastAPI and can accept that the package is aging (332 days since last release). The implementation is sound, dependencies are minimal, and there are no known vulnerabilities. However, verify compatibility with your FastAPI/Starlette versions and be prepared to maintain or fork if upstream updates lag behind framework changes."},"id":"fastapi-csrf-protect","links":{"html":"https://skillfed.io/packages/fastapi-csrf-protect","md":"https://skillfed.io/packages/fastapi-csrf-protect.md","pypi":"https://pypi.org/project/fastapi-csrf-protect/"},"maintenance":{"status":"aging"},"meta":{"latest_release":"2025-09-16","license_spdx":"MIT","license_treatment":"permissive","name":"fastapi-csrf-protect","python_support":"supports_current","summary":"Stateless implementation of Cross-Site Request Forgery (XSRF) Protection by using Double Submit Cookie mitigation pattern"},"popularity":{"monthly_downloads":154965,"position":10835,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.0.7"}